Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 1, 2022 15:22:33 GMT
Chrysler ECU UART Speed
I know the following base speeds
7812 baud.
62500 baud.
Also, according to my data, the ecu can work at speeds
976 baud.
10416 baud.
Judging by the bootloader, it automatically selects the speed.
What will the community say about this?
Konstantin.
|
|
|
|
Post by admin on Feb 1, 2022 15:43:37 GMT
I can confirm all 4 speeds.
7812.5 and 62500 bauds are used most of the time on SCI-bus.
976 baud seems to be rarely used on SCI-bus, perhaps really old ECUs talk that slow.
10416 baud is used for the ISO9141 K-Line protocol (OBD2) multiplexed on OBD2 Pin 7 with an SCI-bus pin. 1996 and later ECUs have another layer of diagnostics functions that comply with OBD2 standards. From what I could gather these functions just call old ones.
Could you elaborate on your findings in the bootloader?
I'm having a hard time understanding how the bootstrap code expects serial communication at 62500 baud when this
ROM:E0068 ldd #1
ROM:E006C std SCCR0 ; Max Speed
sets the baudrate to 500000 baud.
Or is my calculation wrong below?
Baudrate = F_CPU / (32 * SCBR) = 16000000 / (32 * 1) = 500000
I thought when you enter bootstrap mode the ECU configures itself to 62500 baud by default.
|
|
|
|
Post by dino2gnt on Feb 1, 2022 15:53:21 GMT
I can confirm all 4 speeds. 7812.5 and 62500 bauds are used most of the time on SCI-bus. 976 baud seems to be rarely used on SCI-bus, perhaps really old ECUs talk that slow. 10416 baud is used for the ISO9141 K-Line protocol (OBD2) multiplexed on OBD2 Pin 7 with an SCI-bus pin. 1996 and later ECUs have another layer of diagnostics functions that comply with OBD2 standards. From what I could gather these functions just call old ones. Could you elaborate on your findings in the bootloader? I'm having a hard time understanding how the bootstrap code expects serial communication at 62500 baud when this ROM:E0068 ldd #1
ROM:E006C std SCCR0 ; Max Speedsets the baudrate to 500000 baud. Or is my calculation wrong below? Baudrate = F_CPU / (32 * SCBR) = 16000000 / (32 * 1) = 500000I thought when you enter bootstrap mode the ECU configures itself to 62500 baud by default.
I'm also curious about that.
In my disassembly, that line doesn't point to what the datasheet says is SCCR0 ( $FFC08 ?), but my disassembler is also really old and only handles 16bit addressing, so it may be lying to me about the memory address.
Your calculation looks right to me based on what Motorola says:
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 1, 2022 16:07:19 GMT
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 1, 2022 16:26:57 GMT
This thread serves as a pure theoretical interest towards the SBEC3 re-flashing procedure. Nothing written below has been tried by me. The information presented here is gathered from log files of actual re-flashing sessions and from people knowing much more than me, who understandably didn't go much into detail. Note: Chrysler CCD/SCI Scanner is not protected against high programming voltage. Do not attempt to apply higher than +5V voltage to any of its pins! Put a custom protection device between scanner and ECU if need to. Beginning steps: 1. While ignition switch is off apply +20V programming voltage to SCI_RX pin. 2. Turn key on, remove +20V from SCI_RX pin, ECU configures itself to 62500 baud SCI-bus speed. 3. Send a single byte over SCI-bus and wait for response. Not sure what this does, it triggers something. TX: 7F
RX: 06
The value 0x7F acts as a magic byte for the speed calculation. |
|
|
|
Post by dino2gnt on Feb 1, 2022 16:40:27 GMT
The value 0x7F acts as a magic byte for the speed calculation. ohhhhhhhhhhhhhhhhhh shit, that makes perfect sense! So it we send 0x7F and get something unexpected back, we're synced at the wrong speed. |
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 1, 2022 16:49:23 GMT
Only if you send it at a speed of 62500.
For other speeds it is necessary to calculate.
Konstantin.
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 1, 2022 21:27:37 GMT
 Everything is very simple! 500000/62500 = 8 The start bit in a message from the host at 62500 baud is perceived at 500000 baud as one byte (points 1,2). The same happens for bit 8 (points 3,4). It remains for the program to measure the time between points 2 and 4, which is proportional to the speed of the host.
ROM:E007C ldd #55AAh
ROM:E0080
ROM:E0080 wait_rx1: ; CODE XREF: ROM:E008Cj
ROM:E0080 staa SWSR
ROM:E0084 ldz TCNT ; Save to reg Z
ROM:E0088 stab SWSR ; Break WatchDog
ROM:E008C brclr 0FC0Dh, #40h, wait_rx1 ; Check flag RDRF (SCI Status Register)
ROM:E0092 ldaa 0FC0Fh ; empty read
ROM:E0096 bclr 0FC0Bh, #1 ; Stop SBK (Send Break )
ROM:E009A ldd #55AAh
ROM:E009E
ROM:E009E wait_rx2: ; CODE XREF: ROM:E00AAj
ROM:E009E staa SWSR
ROM:E00A2 lde TCNT ; Save to reg E
ROM:E00A6 stab SWSR
ROM:E00AA brclr SCSR_L, #40h, wait_rx2 ;
ROM:E00AA ; Math speed
ROM:E00B0 ldaa 0FC0Fh ; empty read
ROM:E00B4 xgdz
ROM:E00B6 sde
ROM:E00B8 lsre
ROM:E00BA lsre
ROM:E00BC lsre
ROM:E00BE lsre
ROM:E00C0 lsre
ROM:E00C2 lsre
ROM:E00C4 adce #0 ; add carry Flag
ROM:E00C8 ste SCCR0 ; Set Baud
Konstantin. |
|
|
|
Post by admin on Feb 1, 2022 21:58:23 GMT
That's just pure magic.
Gotta step back and marvel at it.
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 2, 2022 22:55:59 GMT
Using byte 0x7F, the requirements of SAE J2610 are fulfilled.
Data Rate Specification—The SCI communication link shall have a default data rate of 7812.5 bps. A
communication session between a diagnostic tester and an ECU shall always be initiated at the default data
rate. A change in data rate can be negotiated once communications are established between the diagnostic
tester and ECU.
The ECU shall automatically track to the requested data rate following a command sequence
from the diagnostic tester.
The command sequence is initiated by transmitting a specific training character to
the ECU.
The ECU shall respond with an acknowledgement character following establishment of the proper
data rate. For proper operation of serial communications, the diagnostic tester and ECU shall support the data
rates as specified in Figure 2.
Description Data Rate Bit Time Tolerance
(Bits per second) (microseconds) (%)
Low-Speed Mode (Default) 7812.5 128.0 +/- 2.0
High-Speed Mode 1 62.5 К 16.0 +/- 2.0
High-Speed Mode 2 125.0 К 8.0 +/- 2.0
|
|
|
|
Post by dino2gnt on Feb 3, 2022 15:23:09 GMT
High-Speed Mode 1
High-Speed Mode 2 Now the Mode 1 / Mode 2 references in the disassembly make more sense.
Genius!
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 3, 2022 15:56:16 GMT
High-Speed Mode 1
High-Speed Mode 2 Now the Mode 1 / Mode 2 references in the disassembly make more sense.
Genius!
Genius!You misunderstood. Using byte 0x7F, you can provide a speed baud tolerance of + - 2%. In fact, it turns out that you can work with the bootloader at almost any speed. The loader itself will adjust to the speed of the master. The mode in the bootloader program is determined by the pin values. Konstantin. |
|
|
|
Post by dino2gnt on Feb 3, 2022 16:13:20 GMT
Yeah, thus the accesses porte & portf...
I should reference the assembly before I open my mouth, sorry.  |
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Feb 3, 2022 16:27:14 GMT
Yeah, thus the accesses porte & portf...
I should reference the assembly before I open my mouth, sorry. Yes ! ROM:E00C4 adce #0 ; round((T2-T1)/64)
ROM:E00C8 ste SCCR0 ; Set new Baud
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Mar 3, 2022 18:28:57 GMT
|
|
